But it will not read outside of the buffer. It will panic at runtime instead. That's not a buffer overrun.

It's still an error discovered at runtime. It's one that smacks you in the face instead of silently doing the wrong thing, but it's still found at runtime. I really prefer my errors to be found at compile time, but that's often harder to do...